NPA collection of data unlawful

By Liu Ching-yi 劉靜怡

The Council of Grand Justices’ Constitutional Interpretation No. 603 puts it clearly: “Where it is necessary for the state to ... set up databases ... for the purposes of any particular major public interest, it shall not only prescribe by law the purposes of such collection, which shall be necessary and relevant to the achievement of the purposes of such major public interest, but also prohibit by law any use other than the statutory purposes ... in a manner that is sufficient to ensure the accuracy and safety of the information ... and take any and all necessary protective measures both organizationally and procedurally ... to protect the people’s right of information privacy.”

However, police have recently been misusing the Cloud Computing Applications and Industry Development Program, and have been using mobile devices to download household registration data to run comparison checks on personal information, including examining ID photos with face recognition programs.

Above and beyond concerns about whether this constitutes an abuse of power in the collection of information, there is absolutely no basis in law for authorities to manage and use personal data this way; indeed, it is in violation of the requirements of the constitutional interpretation cited above. This illegal and unconstitutional political sleight of hand not only tramples over data autonomy and personal dignity, it also runs counter to the fundamental requirement in a country run according to the rule of law that the government be self-regulating. Misuse of power leads to a return to authoritarian rule.

The National Police Agency (NPA) has tried to hush up the issue by invoking the Police Power Exercise Act (警察職權行使法). Although this act does authorize the police to use technology to amass information on participants during marches or public events, the activities must still conform with legal procedure. Using the information obtained in this way to analyze personal information can be considered an invasion of personal rights and rights to data privacy. As this goes against the principle of Vorbehalt des Gesetzes — statutory reservation — how can such a policy be justified? The Household Registration Act (戶籍法) authorizes the creation of an ID photo databank for the purpose of household registration only, so this cannot be used as a justification for the police’s policy.

The purpose of legislating the Personal Information Protection Act (個人資料保護法) was to protect, through procedural stipulations, people’s data privacy and data autonomy.

In essence, it is a personal data protection procedure law and absolutely cannot be transformed into a justification for the public authorities to have access to citizens’ personal information when they need it for “any use other than the statutory purposes.”

If the police want to justify this kind of action, they will have to look elsewhere. If this point is lost on even a major judicial body such as the NPA, how can its professed intention to set up internal controls be effective?

Following the stabbings on Taipei’s MRT metropolitan railway system, the NPA ordered more spot checks on what it calls high-risk groups — homeless people, people with mental disorders and “antisocial types,” and to establish a database to store the information it obtained.